sandbox-run 0.41.0

Cross-platform process sandboxing (Linux Landlock, macOS SBPL) via pre_exec
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

#[cfg(target_os = "linux")]
mod linux;

#[cfg(target_os = "macos")]
mod macos;

use crate::{error::SandboxError, sandbox::SandboxPolicy};

/// Apply the sandbox policy to the current process.
///
/// This should be called in the child process after fork but before exec.
/// After this call, the process will be restricted according to the policy.
pub fn apply_sandbox(policy: &SandboxPolicy) -> Result<(), SandboxError> {
    #[cfg(target_os = "linux")]
    {
        linux::apply_sandbox(policy)
    }

    #[cfg(target_os = "macos")]
    {
        macos::apply_sandbox(policy)
    }

    #[cfg(not(any(target_os = "linux", target_os = "macos")))]
    {
        let _ = policy;
        compile_error!("sandbox-run only supports Linux and macOS")
    }
}

/// Whether the running kernel enforces Landlock (Linux 5.13+ with
/// Landlock enabled). See [`linux::landlock_available`].
#[cfg(target_os = "linux")]
pub use linux::landlock_available;